1. How are you blocking someone from uploading millions of files programmatically?

2. How do you know someone is from small audience of good-faith?

3. What if a file has virus and corrupt all the files on your end?

If you don't need auth, there are few measures you can take on your end:

1. TTL - Make these files temporary - They will be erased after x hours. Eg. x=1

2. Throttle - Limit number of uploads from a given IP/machine or control by uploads per sec

3. May be adding a malware scanner?